feat(console): publish oauth client metadata document

[rekram1-node]

Summary

Publishes an OAuth Client ID Metadata Document (CIMD) for the opencode client at https://opencode.ai/oauth/opencode/client.json.

This is the first half of CIMD support for MCP OAuth. When an MCP authorization server advertises client_id_metadata_document_supported, opencode will be able to present this URL as its client_id instead of doing Dynamic Client Registration against every server. The authorization server fetches the document to learn the client name and allowed redirect URIs. No client-side integration in this PR; that follows separately.

The document is fully public by design: it contains only the app name, logo, redirect URIs, and grant types. This mirrors what OpenAI (chatgpt.com/oauth/codex/client.json), Anthropic, and Microsoft publish for their clients.

Document

{
  "client_id": "https://opencode.ai/oauth/opencode/client.json",
  "client_name": "opencode",
  "client_uri": "https://opencode.ai",
  "logo_uri": "https://opencode.ai/web-app-manifest-512x512.png",
  "application_type": "native",
  "redirect_uris": ["http://127.0.0.1/callback", "http://localhost/callback"],
  "grant_types": ["authorization_code", "refresh_token"],
  "response_types": ["code"],
  "token_endpoint_auth_method": "none",
  "token_endpoint_auth_methods_supported": ["none"]
}

Notes:

• client_id is derived from the request origin so the document stays self-consistent on dev.opencode.ai and preview stages (the spec requires it to equal the exact URL served).
• redirect_uris are portless loopback; opencode binds an ephemeral port per login and RFC 8252 §7.3 has authorization servers ignore the port for native-app loopback redirects. Same choice as Codex and Claude Code.
• application_type: "native" is included explicitly; omitting it defaults to web under RFC 7591 and disables the loopback-port exemption on some servers (this bit Claude Code).
• Served as a SolidStart API route (same pattern as changelog.json.ts) rather than a static file so Content-Type, Cache-Control, and CORS are explicit.

Deployment note

Authorization servers fetch this URL server-side from datacenter IPs. If any Cloudflare bot-protection or WAF rule applies to opencode.ai, /oauth/opencode/client.json needs to be exempt or CIMD logins will fail with a JS-challenge page (this happened to Anthropic's document).